medium5.4
CVE-2020-13870
Comments plugin stored Cross-site Scripting (XSS) via an asset volume name
Impact
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | verbb/comments | < 1.5.5 | 1.5.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Verbb | Comments | before 1.5.5 |